I’m currently running a bunch of services behind a reverse proxy and that proxy is configured to use let’s encrypt for ssl certs using DNS-01 challenges for renewals. All of the services are configured to only work using Tailscale IPs, so, as far as I’m aware, none of the services are open to the internet, except for port 80.
I noticed if I don’t leave port 80 open, when it’s time for renewal, everything fails. This leads to a bunch of logs on my Unifi setup saying intrusion attempts have been blocked on port 80. I thought I could go to Let’s Encrypt’s website and find a list of IPs I could put on an allow list but they don’t post those. So my questions are:
1. If I understand the process correctly, Let’s Encrypt checks the DNS TXT record to verify I own a domain, then sends a new cert to my server over port 80; meaning, I have to have port 80 open during the renewal process, correct? Nope
2. If that’s correct, what do you all do about port 80? Do you just have a script to open the port during the renewal process and close it afterwards or do you just leave it open all the time? Is there maybe a tool that already has this functionality? not if using DNS-01 challenges
3. I think I have port 443 open as well but I don’t remember if that’s needed or if I just did that when I opened port 80 trying to get all my services working again. Does 443 need to be open too? not if using DNS-01 challenges
4. If there is a better way to do all this or if I fucked up somewhere, please share. This was just the first setup I got working. I fucked up, see below
Thanks
EDIT: After deleting the current certificate and going through the process of generating a new one, everything is working without port 80 open. I’m using NGINX Proxy Manager and I must have clicked on “Lets Encrypt via DNS” and not “Lets Encrypt via HTTP” when originally setting this up. Not sure how else this could have happened 😅
If you use DNS-01, you don’t need port 80 open.
Oh. So, that’s only needed for HTTP-01 challenges? Doesn’t my server need to receive a file or something from Let’s Encrypt, how does that work?
The ACME client generates the private key to keep and a signing request to send to the CA. Once the CA validates your challenge type, the client requests the signed cert over that same channel. It doesn’t interact with 80 or 443 except to complete challenges.
When you use DNS for the authentication, a token is stored in DNS and lets encrypt will go and look that up and issue a certificate if everything lines up.
The question is how does that, “issue a certificate” step work and does it require port 80, not what is the 10000 foot view.
It works the same way it normally works. You generate the certificate, give it to them, tell them who you are, they verify who you are, then they sign it and give it back to you. Very routine and straightforward, except for the challenge part that they use to verify your identity.
Think of it in terms of delivering a pizza. The signed certificate is the pizza in this analogy, and they don’t want to send it to you until they’re sure it’s going to the right place. Either the store can send it to you (you have to give them your address and have port 80 open for when they arrive) or you can go pick it up at the store (you give them your address, they verify it through DNS, no port 80 required).
There’s never been anything preventing you from establishing a conversation with the certificate-issuer. You don’t need port 80 open for that. However, unless you have port 80 open the issuer cannot reach out to you, and that’s how they verify you are who you say you are. DNS challenges avoid them having to reach out to you directly, instead they reach out to DNS on your behalf and verify you are who you say you are that way instead.
Again, nobody is asking for the high level view or an analogy. They’re asking for a specific fix.
We don’t have OP’s config so we can’t identify their exact miscommunication.
If you update DNS, that would use DNS-01 challenge and you don’t need port 80 open. I am using this challenge type to generate certs for completely internal services. The only reason to have 80 open would be to use HTTP-01 challenge, which requires your server to host a file on a specific url only via port 80. If your service is already public on 443, you could leave port 80 open with a simple http-to-https redirect.
Port 443 would need to be open if you want to use TLS-ALPN-01 challenge, but I would avoid this as it is not easy to use or configure.
My advice for internal services is to setup only DNS-01 challenge and configure your dns to be automatically updated using a dns plug-in. This should almost never fail validation.
Thank you for the explanation
